RBAC split permissions Permissions to create security principals in the Active Directory domain partition are controlled by Role Based Access Control (RBAC). Only those who are members of the appropriate role groups can create security principals.

Active Directory split permissions Permissions to create security principals in the Active Directory domain partition are completely removed from any Exchange user, service, or server. No option is provided in RBAC to create security principals. Creation of security principals in Active Directory must be performed using Active Directory management tools.

Note:

Active Directory split permissions are available in organizations running Microsoft Exchange Server 2010 Service Pack 1 (SP1) or later, Exchange 2013, or both versions of Exchange.

The model that you choose depends on the structure and needs of your organization. Choose the procedure that follows that's applicable to the model you want to configure. We recommend that you use the RBAC split permissions model. The RBAC split permissions model provides significantly more flexibility while providing the same administration separation as Active Directory split permissions.

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Active Directory split permissions" entry in the Role management permissions topic.

You must use Windows PowerShell, Windows Command Shell, or both, to perform these procedures. For more information, see each procedure.

If you have Exchange 2010 servers in your organization, the permissions model you select will also be applied to those servers.

You can configure your Exchange 2013 organization for RBAC split permissions. When you are done, only Active Directory administrators will be able to create Active Directory security principals. This means that Exchange administrators won't be able to use the following cmdlets:

New-Mailbox

New-MailContact

New-MailUser

New-RemoteMailbox

Remove-Mailbox

Remove-MailContact

Remove-MailUser

Remove-RemoteMailbox

Exchange administrators will only be able to manage the Exchange attributes on existing Active Directory security principals. However, They will be able to create and manage Exchange-specific objects, such as transport rules and distribution groups. For more information, see the "RBAC Split Permissions" section in Understanding split permissions.

To configure Exchange 2013 for split permissions, you must assign the Mail Recipient Creation role and the Security Group Creation and Membership role to a role group that contains members that are Active Directory administrators. You must then remove the assignments between those roles and any role group or universal security group (USG) that contains Exchange administrators.

To configure RBAC split permissions, do the following:

If your organization is currently configured for Active Directory split permissions, do the following from a Windows command shell prompt.

Disable Active Directory split permissions by running the following command from the Exchange 2013 installation media.

Restart the Exchange 2013 servers in your organization or wait for the Active Directory access token to replicate to all of your Exchange 2013 servers.

Note:

If you have Exchange 2010 servers in your organization, you also need to restart those servers.

Do the following from the Exchange Management Shell:

Create a role group for the Active Directory administrators. In addition to creating the role group, the command creates regular role assignments between the new role group and the Mail Recipient Creation role and the Security Group Creation and Membership role.

If you want members of this role group to be able to create role assignments, include the Role Management role. You don't have to add this role now. However, if you ever want to assign either the Mail Recipient Creation role or Security Group Creation and Membership role to other role assignees, the Role Management role must be assigned to this new role group. The steps that follow configure the Active Directory Administrators role group as the only role group that can delegate these roles.

Create delegating role assignments between the new role group and the Mail Recipient Creation role and Security Group Creation and Membership role using the following commands.

Members of the Organization Management role group, or those who are assigned the Role Management role, either directly or through another role group or USG, can bypass this delegate security check. If you want to prevent any Exchange administrator from adding himself or herself to the new role group, you must remove the role assignment between the Role Management role and any Exchange administrator and assign it to another role group.

Find all of the regular and delegating role assignments to the Mail Recipient Creation role using the following command. The command displays only the Name, Role, and RoleAssigneeName properties.

Remove all of the regular and delegating role assignments to the Mail Recipient Creation role that aren't associated with the new role group or any other role groups, USGs, or direct assignments you want to keep using the following command.

If you want to remove all of the regular and delegating role assignments to the Mail Recipient Creation role on any role assignee other than the Active Directory Administrators role group, use the following command. The WhatIf switch lets you see what role assignments will be removed. Remove the WhatIf switch and run the command again to remove the role assignments.

Find all of the regular and delegating role assignments to the Security Group Creation and Membership role using the following command. The command displays only the Name, Role, and RoleAssigneeName properties.

Remove all of the regular and delegating role assignments to the Security Group Creation and Membership role that aren't associated with the new role group or any other role groups, USGs, or direct assignments you want to keep using the following command.

Remove-ManagementRoleAssignment <Security Group Creation and Membership role assignment to remove>

Note:

You can use the same command in the preceding Note to remove all of the regular and delegating role assignments to the Security Group Creation and Membership role on any role assignee other than the Active Directory Administrators role group, as shown in this example.

You can configure your Exchange 2013 organization for Active Directory split permissions. Active Directory split permissions completely remove the permissions that allow Exchange administrators and servers from creating security principals in Active Directory or modifying non-Exchange attributes on those objects. When you are done, only Active Directory administrators will be able to create Active Directory security principals. This means that Exchange administrators won't be able to use the following cmdlets:

Add-DistributionGroupMember

New-DistributionGroup

New-Mailbox

New-MailContact

New-MailUser

New-RemoteMailbox

Remove-DistributionGroup

Remove-DistributionGroupMember

Remove-Mailbox

Remove-MailContact

Remove-MailUser

Remove-RemoteMailbox

Update-DistributionGroupMember

Exchange administrators and servers will only be able to manage the Exchange attributes on existing Active Directory security principals. However, they will be able to create and manage Exchange-specific objects, such as transport rules and Unified Messaging dial plans.

Caution:

After you enable Active Directory split permissions, Exchange administrators and servers will no longer be able to create security principals in Active Directory, and they won't be able to manage distribution group membership. These tasks must be performed using Active Directory management tools with the required Active Directory permissions. Before you make this change, you should understand the impact it will have on your administration processes and third-party applications that integrate with Exchange 2013 and the RBAC permissions model.
For more information, see the "Active Directory split permissions" section in Understanding split permissions.

To switch from shared or RBAC split permissions to Active Directory split permissions, do the following:

From a Windows command shell, run the following command from the Exchange 2013 installation media to enable Active Directory split permissions.

If you have multiple Active Directory domains in your organization, you must either run setup.exe /PrepareDomain in each child domain that contains Exchange servers or objects or run setup.exe /PrepareAllDomains from a site that has an Active Directory server from every domain.

Restart the Exchange 2013 servers in your organization or wait for the Active Directory access token to replicate to all of you Exchange 2013 servers.

Note:

If you have Exchange 2010 servers in your organization, you also need to restart those servers.